diff --git a/roles/debian/nginx/defaults/main.yml b/roles/debian/nginx/defaults/main.yml
index 0d5568b55..33227b07a 100644
--- a/roles/debian/nginx/defaults/main.yml
+++ b/roles/debian/nginx/defaults/main.yml
@@ -129,6 +129,9 @@ nginx:
   php_fastcgi_backend: "127.0.0.1:90{{ php.version[-1] | replace('.', '') }}" # for unix socket use "unix:/var/run/php{{ php.version[-1] | replace('.','') }}-fpm.sock"
   ratelimitingcrawlers: false
   client_max_body_size: "700M"
+  ssl_ciphers: [] # Defaults to empty list, you can add ciphers if needed
+#   - ECDHE-RSA-AES256-GCM-SHA384
+#   - ECDHE-RSA-CHACHA20-POLY1305
   # drupal_fallback: []
   # Default location behavior for nginx
   # If no custom location behavior is defined, this will be used:
diff --git a/roles/debian/nginx/templates/nginx.conf.j2 b/roles/debian/nginx/templates/nginx.conf.j2
index 9b3dbd5f0..212b794a2 100644
--- a/roles/debian/nginx/templates/nginx.conf.j2
+++ b/roles/debian/nginx/templates/nginx.conf.j2
@@ -43,7 +43,9 @@ http {
 
     ssl_protocols {{ nginx.http.ssl_protocols }}; # Dropping SSLv3, ref: POODLE
     ssl_prefer_server_ciphers on;
-
+    {% if nginx.ssl_ciphers is defined and nginx.ssl_ciphers|length > 0 %}
+    ssl_ciphers {{ nginx.ssl_ciphers | join(':') }};
+    {% endif %}
     ##
     # Logging Settings
     ##